Running head: COMPUTER CRIMES CASE SIMULATION AND DESIGN MODEL Computer Crimes Case Simulation and Design Model “Kitty” Exploitation and Illicit Drug Activities Submitted by Maritza Stephanie Jeremias University of Central Oklahoma W. Roger Webb Forensic Science Institute Dr. Joe C. Jackson College of Graduate Studies University of Central Oklahoma Edmond, Oklahoma 11/30/2018 This thesis is submitted to The Jackson College of Graduate Studies University of Central Oklahoma In Partial Fulfillment of the Requirements for the Degree of Master of Science in Forensic Science COMPUTER CRIMES CASE SIMULATION AND DESIGN MODEL ii Computer Crimes Case Simulation and Design Model “Kitty” Exploitation and Illicit Drug Activities Submitted by Maritza Stephanie Jeremias University of Central Oklahoma Graduate Thesis Approved by the W. Roger Webb Forensic Science Institute 11/30/2018 COMPUTER CRIMES CASE SIMULATION AND DESIGN MODEL 1 Acknowledgments I would like to thank my graduate thesis advisor and committee chair, Dr. Mark R. McCoy, of the University of Central Oklahoma, Forensic Science Institute. Dr. McCoy provided me with the support and resources necessary to complete this project. I must also thank my thesis committee members, Dr. Wayne Lord and Dr. John P. Mabry, for their insight and dedication. I greatly appreciate the time and dedication put forth by the entire Forensic Science Institute faculty and staff members at the University of Central Oklahoma. I am grateful to my employers for not only encouraging me to pursue and complete my Master of Science in Forensic Science, but also for allowing me to continue to work full-time through a flexible schedule around my classes and coursework. Additionally, I am appreciative of my friends and classmates for taking the time out of their busy lives to review the multiple revisions of my thesis paper. Lastly, I wish to express my gratitude to my family. To my mom, Maria, thank you for always having faith in me and doing everything within your power to ensure my brothers and I achieve our goals in life. To my younger brothers, Adam and Eddie, I am very proud of how much the both of you have accomplished this far and I cannot wait to see all that you achieve in the future. COMPUTER CRIMES CASE SIMULATION AND DESIGN MODEL 2 Abstract The overall purpose of this graduate project is to provide digital forensics instructors at the University of Central Oklahoma (UCO) with a manually generated computer crimes case simulation that offers students a replicated real-world experience of what it is like being a practicing digital forensic examiner. This simulation offers digital forensic students an opportunity to apply their forensic knowledge and skills in a realistic environment. Secondarily, this project sought to develop a rudimentary computer crimes simulation design model. The case simulation provides scenario/simulation-based learning to future digital forensic students at UCO. The computer crimes simulation design model presents general steps and considerations that should be taken when generating similar digital forensic simulations. The generated simulation portrays typical “kitty” exploitation and illicit drug activities and consists of two computer crimes case scenarios, two sets of investigative notes, two search warrant affidavits, eight crime scene processing forms, a solution report with associated PowerPoint presentation for the instructors, the digital evidence, a bootable clone of the evidence, and a disk image of the evidence. Keywords: computer crime, digital crime, cyber crime, computer forensics, digital forensics, forensic triage, crime scene processing, digital evidence, disk image, disk clone, forensic analysis, anti-computer, counter-computer, anti-forensics, counter-forensics, forensic training, forensic simulations, forensic scenario, forensic case study COMPUTER CRIMES CASE SIMULATION AND DESIGN MODEL 3 Table of Contents ACKNOWLEDGMENTS ........................................................................................................................................... 1 ABSTRACT ................................................................................................................................................................. 2 TABLE OF CONTENTS ............................................................................................................................................ 3 INTRODUCTION ....................................................................................................................................................... 6 Simulation-based Training in the Forensic Science Education ............................................................... 7 Obtaining Digital Forensic Data for Research, Education, and Training Purposes ................................ 8 Problem Statement .................................................................................................................................. 9 Project Statement and Objectives ............................................................................................................ 9 BACKGROUND ........................................................................................................................................................ 10 Commonly Performed Computer User Activities ................................................................................. 11 Commonly Utilized Software ................................................................................................................ 12 System software. ........................................................................................................................................... 12 Application software (End-user software). .................................................................................................... 13 Basic Anti-Computer Forensics Techniques & Tools ........................................................................... 14 Data hiding. ................................................................................................................................................... 14 Artifact wiping. ............................................................................................................................................. 15 Trail obfuscation. .......................................................................................................................................... 16 Definition of Terms ............................................................................................................................... 16 RELATED WORK .................................................................................................................................................... 18 METHODOLOGY .................................................................................................................................................... 20 Experimental Design and Materials ...................................................................................................... 20 Simulation design framework........................................................................................................................ 20 Scenario design. ............................................................................................................................................ 23 Hardware selection. ....................................................................................................................................... 24 COMPUTER CRIMES CASE SIMULATION AND DESIGN MODEL 4 Software selection. ........................................................................................................................................ 25 Operating system selection...................................................................................................................................... 25 Web browser selection. ........................................................................................................................................... 27 Search engine selection. .......................................................................................................................................... 27 Email selection. ....................................................................................................................................................... 28 Instant messenger selection. .................................................................................................................................... 28 Online social media platform selection. .................................................................................................................. 28 Selection of additional software. ............................................................................................................................. 29 Selection of computer user activities. ............................................................................................................ 29 Browsing activities. ................................................................................................................................................. 31 Experiment Implementation .................................................................................................................. 32 Creating the evidence. ................................................................................................................................... 32 Computer activities